one moment
Trust & security
Plain English on how we protect your site, your data, and your identity. No marketing acrobatics.
Application data is stored in Neon Postgres (US-East), AES-256-GCM enveloped via pgcrypto with per-row data-encryption keys. The key-encryption key sits in Cloudflare Secrets Store and rotates quarterly via an automated workflow.
Every connection is TLS 1.3 with HSTS preload. Internal calls between the Worker and the assistant agent traverse a Cloudflare Tunnel gated by service-token authentication.
Email + password (8+ characters, bcrypt-hashed), Google + Microsoft OAuth, magic links, and passkeys. Two-factor (TOTP) is available for any account; required for operator-level access.
Cloudflare Turnstile guards sign-up, sign-in, and password reset. Rate limits cap brute-force attempts. Suspicious sign-ins trigger an email alert.
Daily Neon snapshots restored to a clean branch each night by an automated workflow. Weekly snapshots retained for 26 weeks. Restore-to-point is one click in the portal.
The key-encryption key rotates every 90 days. All active data-encryption keys are re-wrapped without downtime. Audit log captures every rotation event.
Every privileged action — sign-in, password change, MFA enrollment, redesign approval, billing event — writes to an append-only audit log scoped to your org. Exportable as CSV.
Reporting a vulnerability
We treat security disclosures with respect. We don't lawyer up, we don't blame the messenger.
Security contact
security@hbservices.netReplies within one business day. Acknowledgement within 24 hours, even on weekends, for confirmed user-impacting issues.
View security.txt →Common questions
Application data: Neon Postgres in US-East-2 (Ohio). Static assets and screenshots: Cloudflare R2. Edge cache and DNS: Cloudflare global. We don't replicate data outside the US.
Not yet. The infrastructure is built to those standards (encryption, audit, RBAC, MFA, backups) but we haven't completed a formal audit. Once we cross ~50 active clients we'll begin a SOC 2 Type II.
We sign DPAs on request. We retain only what's required to run the service. You can export or delete your data any time from your settings page or by emailing legal@hbservices.net.
Never. We have no third-party advertising, no data brokers, no analytics that profile individuals. Internal analytics (PostHog) are limited to product usage and respect opt-out.
Stripe processes all payments. Card numbers never touch our servers — Stripe Elements tokenize on the client. We store a customer ID and a card brand/last-four for receipts.
Anomaly → automated paging → triage → customer notification within 24 hours of confirmed user-impacting incident. Post-mortem published within 7 days. Disclosures via your portal and the status page.
More to ask? security@hbservices.net or book a consultation.
Hambone
HB Services AI assistant
Hi — I’m Hambone.
Ask me about the practice, what AI could do for your business, or how engagements work. I keep answers short.
